CVE-2024-49357 ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as http:///v1/users/image?path=/var/lib/casaos/1/apporder.json and http:///v1/users/image?path=/var/lib/casaos/1/system.json,...

Misconfigured UN Database Exposes 228GB of Gender Violence Victims’ Data

A cybersecurity researcher discovered a massive data leak exposing over 115,000 sensitive documents associated with the UN Trust…...

The vulnerability of the dpaa_start_xmit() function in the Linux operating system allows a hacker to compromise the confidentiality and accessibility of protected information.

The vulnerability of the dpaastartxmit function in the drivers/net/ethernet/freescale/dpaa/dpaaeth.c module of the Linux kernel is related to a data leak. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and accessibility of the protected information...

CVE-2023-50355

HCL Sametime is impacted by the error messages containing sensitive information. An attacker can use this information to launch another, more focused attack...

CVE-2023-22649 Rancher 'Audit Log' leaks sensitive information

A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. Rancher Audit Logging is an opt-in feature, only deployments that have it enabled and have AUDITLEVEL set to 1 or above are impacted by this issue...

CVE-2023-22649 Rancher 'Audit Log' leaks sensitive information

A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. Rancher Audit Logging is an opt-in feature, only deployments that have it enabled and have AUDITLEVEL set to 1 or above are impacted by this issue...

Local File Inclusion (LFI)

phpoffice/phpspreadsheet is vulnerable to Local File Inclusion LFI. The vulnerability is due to PhpSpreadsheet retrieving image sizes and types by reading the contents of files from external URLs, allowing attackers to exploit php://filter URLs to leak sensitive file contents or data from arbitra...

CentOS 6 : chromium-browser (RHSA-2020:3723)

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3723 advisory. - Use after free in presentation API in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to potentially exploit heap corruption via a...

CentOS 7 : kpatch-patch (RHSA-2022:0592)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0592 advisory. - In doepollctl and eploopcheckproc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of...

CVE-2024-47011

Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information...

PT-2024-9617

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description The issue is related to an out-of-bounds read vulnerability in the parse ds64 function within gstwavparse.c. This vulnerability allows reading beyond the bounds of the data buffer, potentially...

A week in security (September 23 – September 29)

Last week on Malwarebytes Labs: Millions of Kia vehicles were vulnerable to remote attacks with just a license plate number Privacy watchdog files complaint over Firefox quietly enabling its Privacy Preserving Attribution Telegram will hand over user details to law enforcement Don’t share the vir...

SolarWinds Serv-U 15.0 < 15.3.1

The version of SolarWinds Serv-U installed on the remote host is prior to 15.3.1. It is, therefore, affected by a vulnerability as referenced in the serv-u1531 advisory. - This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of...

Oceanic Software ValeApp 安全漏洞

ValeApp is a mobile application from Oceanic Software for providing convenient and fast parking services. A security vulnerability previously existed in Oceanic Software ValeApp version 2.0.0, which originated from the inclusion of a sensitive information leak that could lead to JavaScript...

Dell Hit by Third Data Leak in a Week Amid “grep” Cyberattacks

Dell faces its third data leak in a week as hacker "grep" continues targeting the tech giant. Sensitive…...

PortSwigger Web Security: cgi scripts wordlist entry for windmail.exe has payload that sends arbitrary file read result to third-party

The windmail.exe application in the CGI scripts wordlist had a vulnerability that allowed an attacker to read arbitrary files on the server and send the contents to a third-party email address...

CVE-2024-8612 Qemu-kvm: information leak in virtio devices

A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueuepush as set in virtioscsicompletereq / virtioblkreqcomplete / viritocryptoreqcomplete could be larger than the true size of the data which has been sent to guest. Once virtqueuepush finally...

SUSE CVE-2024-46794

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix data leak in mmioread The mmioread function makes a TDVMCALL to retrieve MMIO data for an address from the VMM. Sean noticed that mmioread unintentionally exposes the value of an initialized variable val on the stack...

CVE-2024-46979 Data leak of notification filters of users in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to notification filters of any user by using a URL such as...

CVE-2024-46979 Data leak of notification filters of users in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to notification filters of any user by using a URL such as...